<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
  
<!-- Mirrored from bos.asmhackers.net/docs/filesystems/ntfs/Boot.html by HTTrack Website Copier/3.x [XR&CO'2013], Tue, 07 Oct 2014 11:26:07 GMT -->
<head>
    <title>NTFS Documentation: $Boot</title>
  </head>

  <body>
    <h1><a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> Documentation: $Boot</h1>

    <h2>Definition</h2>

    This is the <a href="MFT.html#system_file" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/MFT.html#system_file">system file</a> that allows the system to boot. 
    <p>

    <h2>Layout</h2>
    The first 28 bytes are the same as for FAT boot <a href="glossary.html#Sector" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Sector">sector</a>s, except that unused fields are zeroed.
    <p>

    <table border=2 cellspacing=2 cellpadding=2>
      <tr bgcolor="#E0E0E0">
	<th>Offset to the beginning of the <a href="data.html#layout" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html#layout">data stream</a></th>
        <th>Length</th>
        <th>Description</th>
      </tr>
      <tr>
	<th>0</th>
	<th>3</th>
	<th>Jump to the <a href="#blr">boot loader routine</a></th>
      </tr>
      <tr>
	<th>3</th>
	<th>8</th>
	<th>System ID: &quot;NTFS    &quot;</th>
      </tr>
      <tr>
	<th>B</th>
	<th>2</th>
	<th><a href="glossary.html#Sector" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Sector">Sector</a> size of the storage unit</th>
      </tr>
      <tr>
	<th>D</th>
	<th>1</th>
	<th>Number of <a href="glossary.html#Sector" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Sector">sector</a>s per <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a></th>
      </tr>
      <tr>
	<th>E</th>
	<th>7</th>
	<th>Unused</th>
      </tr>
      <tr>
	<th>15</th>
	<th>1</th>
	<th><a href="#md">Media descriptor</a></th>
      </tr>
      <tr>
	<th>16</th>
	<th>2</th>
	<th>Unused</th>
      </tr>
      <tr>
	<th>18</th>
	<th>2</th>
	<th>Number of <a href="glossary.html#Sector" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Sector">sector</a>s per track</th>
      </tr>
      <tr>
	<th>1A</th>
	<th>2</th>
	<th>Number of heads</th>
      </tr>
      <tr>
	<th>1C</th>
	<th>8</th>
	<th>Unused</th>
      </tr>
      <tr>
	<th>24</th>
	<th>2</th>
	<th>Always 00 80?</th>
      </tr>
      <tr>
	<th>26</th>
	<th>2</th>
	<th>Always 00 80?</th>
      </tr>
      <tr>
	<th>28</th>
	<th>8</th>
	<th>Number of <a href="glossary.html#Sector" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Sector">sector</a>s in the storage unit</th>
      </tr>
      <tr>
	<th>30</th>
	<th>8</th>
	<th><a href="glossary.html#LCN" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#LCN">LCN</a> associated to <a href="attribute.html#VCN" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html#VCN">VCN</a> 0 of the <a href="data.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html">data attribute</a> of <a href="MFT.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/MFT.html">$MFT</a></th>
      </tr>
      <tr>
	<th>38</th>
	<th>8</th>
	<th><a href="glossary.html#LCN" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#LCN">LCN</a> associated to <a href="attribute.html#VCN" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html#VCN">VCN</a> 0 of the <a href="data.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html">data attribute</a> of <a href="MFTMirr.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/MFTMirr.html">$MFTMirr</a></th>
      </tr>
      <tr>
	<th>40</th>
	<th>4</th>
	<th><a name="f40_field"><a href="#frs">FILE record size in clusters</a></a></th>
      </tr>
      <tr>
	<th>44</th>
	<th>4</th>
	<th><a href="INDX.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/INDX.html">Index buffer</a> size in <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a>s</th>
      </tr>
      <tr>
	<th>48</th>
	<th>4</th>
	<th><a href="glossary.html#Volume" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Volume">Volume</a> serial number</th>
      </tr>
      <tr>
	<th></th>
	<th></th>
	<th></th>
      </tr>
      <tr>
	<th>50</th>
	<th>D</th>
	<th>Unused</th>
      </tr>
      <tr>
	<th>5D</th>
	<th>1A1</th>
	<th><a name="blr">Boot loader routine</a></th>
      </tr>
      <tr>
	<th>1FE</th>
	<th>2</th>
	<th>Magic boot <a href="glossary.html#Sector" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Sector">sector</a> ID: AA 55</th>
      </tr>
      <tr>
	<th>200</th>
	<th></th>
	<th>More code. Probably the <a href="javascript:if(confirm('http://www.microsoft.com/ntserver/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.microsoft.com/ntserver/'" tppabs="http://www.microsoft.com/ntserver/">Windows NT&reg;</a> Loader</th>
      </tr>
      <tr>
	<th></th>
	<th></th>
	<th></th>
      </tr>
      <tr>
	<th>End of <a href="data.html#layout" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html#layout">stream</a> - 200</th>
	<th>200</th>
	<th><a name="copy">Copy of the first 200 bytes</a></th>
      </tr>
    </table>
    <p>

    <dl>
      <dt><a name="md">Media descriptor</a>
        <dd>F8 for a hard disk
        <p>

      <dt><a name="frs"><a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a> size in <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a>s</a>
        <dd>F6 seems to indicate 1/4
        <p>

    </dl>
    <p>

    <h2>Interest</h2>

    Because this <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> begins with a boot <a href="glossary.html#Sector" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Sector">sector</a>, it must start at physical <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a> 0 (this is the only <a href="glossary.html#Cluster" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Cluster">cluster</a> that <a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> can not move). This forces the <a href="data.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html">data attribute</a> of this <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> to be <a href="attribute.html#non_resident" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html#non_resident">non-resident</a>. Consequently, the <a href="#copy">copy of the boot sector</a> (critical data) can be located anywhere on the <a href="glossary.html#Volume" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Volume">volume</a>. For crash recovery purpose, <a href="javascript:if(confirm('http://www.microsoft.com/ntserver/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.microsoft.com/ntserver/'" tppabs="http://www.microsoft.com/ntserver/">Windows NT&reg;</a> 3.5 puts it in the logical middle of the <a href="glossary.html#Volume" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Volume">volume</a>, and <a href="javascript:if(confirm('http://www.microsoft.com/ntserver/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.microsoft.com/ntserver/'" tppabs="http://www.microsoft.com/ntserver/">Windows NT&reg;</a> at the end of the <a href="glossary.html#Volume" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Volume">volume</a>.
    <p>

    <hr>
    <address><a href="mailto:rduchesne@infovistaus.com">Regis Duchesne</a></address>
<!-- Created: Tue Jan 26 18:32:13 PST 1999 -->
<!-- hhmts start -->
Last modified: Mon Feb 15 06:56:02 PST 1999
<!-- hhmts end -->
  </body>

<!-- Mirrored from bos.asmhackers.net/docs/filesystems/ntfs/Boot.html by HTTrack Website Copier/3.x [XR&CO'2013], Tue, 07 Oct 2014 11:26:07 GMT -->
</html>
